Vulnerability Spotlight: Use-after-free vulnerabilities in Foxit PDF Reader
Summary: Cisco Talos discovered three use-after-free vulnerabilities in Foxit PDF Reader, tracked as TALOS-2021-1294 (CVE-2021-21831), TALOS-2021-1307 (CVE-2021-21870) and TALOS-2021-1336 (CVE-2021-21893), which could let an adversary execute arbitrary code on a victim machine. Exploitation requires tricking a user into opening a specially crafted malicious PDF, and Talos confirmed version 11.0.0.49893 could be exploited while working with Foxit to release an update.
Key Takeaway: The reader supports JavaScript for interactive documents and dynamic forms, so the malicious file arrives as an ordinary document a user is expected to open. Talos published six Snort rules (56122, 56123, 57479, 57480, 57830 and 57831) to detect exploitation attempts, and notes additional rules may follow.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2021-21831CVE-2021-21870CVE-2021-21893
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026